Published on Nov 18 2011 in Java Tomcat

In Tomcat 4.x and upper versions, the Default Servlet serves static content. The Tomcat Functional Specifications require that implementations accept several parameters - including one that indicates whether to provide directory listings when a directory without welcome files is requested.

To suppress directory listings in Tomcat, set the value of the servlet's initialization parameter listings to false in Tomcat's default deployment descriptor ($CATALINA_HOME/conf/web.xml). Below is Tomcat's default definition for the default servlet with directory listings disabled:

<servlet>
    <servlet-name>default</servlet-name>
    <servlet-class>
         org.apache.catalina.servlets.DefaultServlet
    </servlet-class>
    <init-param>
       <param-name>debug</param-name>
       <param-value>0</param-value>
    </init-param>
    <init-param>
       <param-name>listings</param-name>
       <param-value>false</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
    </servlet>

See also related chapter in Tomcat 7 documentation.